Event ID 537

[Wullie]

Hi,

Over the last 48 hours, we have one server with the following error happening randomly. It might go 10 hours without happening, then happens twice within an hour. (There is no obvious pattern)

Logon Failure:
 	Reason:		An error occurred during logon
 	User Name:	
 	Domain:		
 	Logon Type:	3
 	Logon Process:	Authz   
 	Authentication Package:	Kerberos
 	Workstation Name:	SERVERNAME
 	Status code:	0xC0000001
 	Substatus code:	0x0
 	Caller User Name:	SERVERNAME$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID:	1836
 	Transited Services:	-
 	Source Network Address:	-
 	Source Port:	-

Everything I can find about this seems to relate to time sync in an AD environment, however there is no AD involved in our situation.

When the error appears, IIS hangs and only comes back after an IISRESET.

I've tried enabling Kerberos debugging (showed nothing at all), installed a few hotfixes relating to Kerberos and also rebooted, but the problem is still occuring.

Any ideas where to look/what to try?

Thanks in advance.

 

[Wullie]

Anyone?

 

[porkchopexpress]

What programs and services are you running on the box?

I assume you are running 2003 SP1.

Have you checked EventID.net?

http://www.eventid.net/display.asp?eventid=537&eventno=194&source=Security&phase=1

You know what Jack Burton always says at a time like this...